CVE-2026-37064

User enumeration in /vfm-admin/ajax/usr-check.php in Veno File Manager Project 4.4.9 allows an unauthenticated attacker to enumerate the application users via sending a specially crafted POST request to the affected endpoint with a chosen 'username' parameter to test if the user exists...

CVE-2026-30046

A reachable assertion vulnerability in the NUDM-UECM interface of Open5GS v2.7.6 allows attackers to cause a Denial of Service DoS via supplying a crafted DELETE request...

PT-2026-82518

An integer overflow in the /nnrf-disc/v1/nf-instances component of open5gs v2.7.6 allows attackers to cause a Denial of Service DoS via supplying a crafted HTTP/2 GET request...

CVE-2026-37071: Improper Privilege Management

Arbitrary File Rename Leading to Privilege Escalation in Actions::renameFile function in Veno File Manager Project 4.4.9 allows an authenticated attacker with 'reanme' permission to take over the super administrator account via a specially crafted POST request to the affected endpoint renaming th...

CVE-2026-37073: Improper Access Control

Incorrect access control in /vfm-admin/ajax/sendfiles.php in Veno File Manager Project 4.4.9 allows an unauthenticated attacker to send emails from the configured SMPT server on the application via making a POST request to the endpoint with needed parameters and header...

CVE-2026-30045

An integer overflow in the /nnrf-disc/v1/nf-instances component of open5gs v2.7.6 allows attackers to cause a Denial of Service DoS via supplying a crafted HTTP/2 GET request...

PT-2026-82448

Name of the Vulnerable Software and Affected Versions Apache APISIX versions 2.12.0 through 3.17.0 Description An inconsistent interpretation of HTTP requests, known as HTTP Request/Response Smuggling, occurs on serverless-plugin routes. This allows an attacker to manipulate the request stream so...

CVE-2026-30073

An issue in the NssaiAvailabilitySubscriptionCreate component of free5gc v4.0.1 allows attackers to cause a Denial of Service DoS via a crafted POST request...

CVE-2026-30045: Integer Overflow or Wraparound

An integer overflow in the /nnrf-disc/v1/nf-instances component of open5gs v2.7.6 allows attackers to cause a Denial of Service DoS via supplying a crafted HTTP/2 GET request...

PT-2026-82850

WatchGuard Dimension's Web UI exposes an administrator passphrase change action that lacks CSRF protection. An attacker who can induce an authenticated global administrator's browser to visit a crafted link or page can change that administrator's passphrase to an attacker-chosen value without the...

SQLite Driver Software Privilege Escalation

The vulnerability of the SQLite driver software used by Adminer for database management involves incorrect restrictions on the path to the catalog. Exploiting this vulnerability allows a malicious actor to gain access and delete any files by sending a specially crafted POST request...

CVE-2026-30073

The free5gc v4.0.1 software contains a vulnerability in the NssaiAvailabilitySubscriptionCreate component. An attacker can trigger a Denial of Service (DoS) by sending a crafted POST request . The RAPID7 documentation indicates that the underlying cause is an Allocation of Resources Without Limit...

PT-2026-82520

A reachable assertion vulnerability in the /nsmf-pdusession/v1/sm-contexts component of Open5GS v2.7.6 allows attackers to cause a Denial of Service DoS via supplying a crafted DELETE request...

CVE-2026-30047

A reachable assertion vulnerability in the /nsmf-pdusession/v1/sm-contexts component of Open5GS v2.7.6 allows attackers to cause a Denial of Service DoS via supplying a crafted DELETE request...

CVE-2026-30047: Reachable Assertion

A reachable assertion vulnerability in the /nsmf-pdusession/v1/sm-contexts component of Open5GS v2.7.6 allows attackers to cause a Denial of Service DoS via supplying a crafted DELETE request...

CVE-2026-30059

An issue in the NAS decoder component of free5gc v4.0.1 allows attackers to cause a Denial of Service DoS via a crafted Registration Request message...

CVE-2026-30051

An issue in the CreateUEContextProcedure function /v1/ue-contexts/supi of free5gc v4.1.0 allows attackers to cause a Denial of Service DoS via supplying a crafted PUT request...

CVE-2026-30059: Allocation of Resources Without Limits or Throttling

An issue in the NAS decoder component of free5gc v4.0.1 allows attackers to cause a Denial of Service DoS via a crafted Registration Request message...

CVE-2026-30050

An issue in the ModifyAMFEventSubscriptionProcedure function processor/eventexposure.go of free5gc v4.1.0 allows attackers to cause a Denial of Service DoS via supplying a crafted PATCH request...

PT-2026-82579

Name of the Vulnerable Software and Affected Versions AVideo versions prior to 24.0 Description An issue exists in the isSSRFSafeURL function where it fails to extract embedded IPv4 addresses from NAT64, 6to4, and Teredo IPv6 transition address formats. Unauthenticated attackers can bypass...